SARBANES-OXLEY AND NONPROFIT ORGANIZATIONS 

February 2004

High profile corporate scandals during the last few years caused Congress to pass landmark legislation - the Sarbanes-Oxley Act of 2002 (SOX, the Act) - intended to help the federal government more effectively regulate the financial reporting and audits of companies registered with the SEC. The Act does not target nonprofit organizations. Given high profile controversies at the United Way, the American Red Cross, and others, however, questions have been raised by New York, California, and other states addressing whether SOX-type regulations should be adopted for nonprofits. While no mandate has been passed yet, it appears at least some states will eventually pass laws or adopt regulations heading in that direction.

Even if no state adopts SOX-type regulations, nonprofits have already felt the Act's impact. Regulators and donors have generally higher expectations of financial reporting and management accountability. Auditors are expected to be more skeptical which will lead to more questioning of more members of management during audits. The IRS Form 990 requires more extensive disclosures about governance and transactions. And members of the board of directors are generally becoming more concerned about their responsibilities and potential liabilities. Accordingly, nonprofit organizations should consider adopting some of the following practices addressed in the Act.

1. The board of directors should establish an audit committee if it does not already have one. The audit committee should operate within guidelines established in the Act. This includes having at least one member knowledgeable of financial and accounting matters; serving as a liaison between the auditor and management, including the rest of the board; and monitoring the nature and amount of non-audit services provided by the audit firm. Generally, allowable services include, but are not limited to, routine tax preparation and consultation on tax, accounting, financial reporting, internal control, and general business matters. Management, however, must take responsibility for and oversee the work of the audit firm to ensure the auditor is not effectively put into a position of making management decisions.



2. The audit committee should ensure that the lead audit partner/shareholder be rotated every five years. The Act specifically does not require the audit firm be rotated every five years because of the cost, disruption and other potential problems caused by changing auditors. Changing certain audit personnel, however, was found to be a cost effective alternative to help ensure the independence of individual auditors within the audit firm.



3. The board of directors should have at least some "independent" members (i.e., individuals who are not organization members, management staff or key donors), preferably with knowledge of or expertise in financial and accounting matters.



4. In hiring an individual as CEO, CFO, Controller, or comparable positions of responsibility, the organization should not consider someone employed by the audit firm during the one year period preceding the audit, unless the board's audit committee is actively involved in the audit and approves the hire.



5. The board should establish and/or update the organization's conflict of interest policy.



6. The board's audit committee should establish procedures to investigate and resolve complaints by employees, donors, members, and others about internal controls or financial reporting matters. The procedures should provide "whistle blower protection", especially for employees.



7. The organization should evaluate and train program directors and staff to improve their understanding of internal financial reports, budgeting and other financial management processes.